2

I have a fixed number of VMs in my Windows/IIS website setup, which I cannot change in the short term:

  • a web server, which is badly overloaded from a memory and cpu load standpoint (IIS6, Server 2003)
  • a SQL Server database (SQL Server 2005, Server 2003)
  • two AD controllers

I have some background services that currently run on the webserver to run heavy lifting-type offline database maintenance work, that sometimes grabs large chunks of memory and cpu itself. I want to move them off. What are the pros and cons of moving it to the SQL Server or an AD controller? Which is better for overall system performance? What do you recommend?

No need to suggest I change my hardware configurations -- I can't.

Improve this question
3
  • 1
    Could you shift resources from your domain controllers to your web server? If the DC's are only running AD and it's a small environment, they really don't need much. I run a Server 2k3 DC at one small site that is assigned just 1vCPU and 1GB of RAM and it works great.
    – jlehtinen
    Nov 15, 2013 at 19:04
  • I am maxxed out on RAM on web and database, it's 32-bit Server 2003 so I have physical limits there.
    – Scott Stafford
    Nov 15, 2013 at 19:36
  • It's hard to do things properly on a shoestring budget. What is the maximum damage you are willing to accept by sacrificing basic security best practices?
    – oleschri
    Nov 16, 2013 at 1:29

3 Answers 3

Reset to default
6

Never put applications on domain controllers if you can help it. There are no local accounts on DCs, so any principal with machine-level rights has domain-level rights.

(There's no such thing as a "secondary server" in AD.)

Improve this answer
5

It is generally a really bad idea to combine different roles with domain controllers - there are security ramifications on most everything. The whole SBS market revolves around that fact.

If at all possible you should look at reprovisioning your existing machines even if you can't upgrade the physical hardware underneath. Most any of the major vendors will allow you to overprovision your RAM and having more virtual CPUs doesn't hurt things in any modern environment.

EDIT:

Problems in running additional services on DCs include but aren't limited to the following.

Services run on domain controllers under the SYSTEM account will pick up domain admin equivalent permissions. This lets a breach is an otherwise less important service compromise your entire environment.

If you opt to demote a domain controller strange things will happen with group memberships, etc associated with software that has been installed.

For example a print server that is on a demoted domain controller won't have a print operator group (the group will stay tattooed to the domain, not migrate back to the local server). The same thing will happen with SQL, etc.

Improve this answer
1
  • I've already reprovisioned to the extent I can - I'm currently running 32 bit Server 2003 and cannot change that (at the moment) so my usable provision limits are pretty low with regards to RAM. Can you elaborate on the "really bad idea" with specific issues?
    – Scott Stafford
    Nov 15, 2013 at 19:35
1

If it's the heavy SQL lifting jobs clogging your webserver, I suggest moving them onto the SQL server. That has the additional advantage that all operations run locally on that machine which may even speed things up a bit.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.